MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 15


Maldoc score: 855


Intelligence 15 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b
SHA3-384 hash: 55da08a45b453abb79ac8e1f7b9b579bf387c634d4e2f0cbab968f5112e426d9020f03eb45bf833fb8f694f02527be7f
SHA1 hash: 094b4e277e07d60c6f2b31b629a503e55d3268a0
MD5 hash: dcb4c95311d6c9f5519b1f66a0b5aa26
humanhash: lemon-friend-wisconsin-comet
File name:TOKTOM_AI_Update.xlsm
Download: download sample
File size:2'337'149 bytes
First seen:2026-08-08 17:29:37 UTC
Last seen:Never
File type:Excel file xlsm
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 49152:Mpsc2PGcXoKIJTQHC1O1WXELed/oh+A1hDIvlppikESOe8cR:MpscN1BUC1O1W0TspvYSOZi
TLSH T11CB53322425B39F7D67E887B641CF8E52A0877C41089AC7A21D25C0B1775BEB9049FFE
TrID 42.4% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13)
29.2% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12)
17.3% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7)
8.9% (.ZIP) Open Packaging Conventions container (17500/1/4)
2.0% (.ZIP) ZIP compressed archive (4000/1)
Magika xlsx
Reporter abuse_ch
Tags:xlsm

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 855
File Format is MS Excel 2007+
Container Format is OpenXML
Office document contains VBA Macros
Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hashdc.creator# of relations
dc935969466cecdfd013b4041e0ed105ijhbfiujbuifbNone
OLE dump

MalwareBazaar was able to identify 37 sections in this file using oledump:

Section IDSection sizeSection name
A1860 bytesPROJECT
A2251 bytesPROJECTwm
A35001 bytesVBA/Module1
A43022 bytesVBA/Module2
A53213 bytesVBA/Module3
A64352 bytesVBA/Module4
A74452 bytesVBA/Module5
A84695 bytesVBA/Module6
A92008 bytesVBA/Module7
A101150 bytesVBA/Sheet1
A111150 bytesVBA/Sheet2
A122975 bytesVBA/ThisWorkbook
A135298 bytesVBA/_VBA_PROJECT
A143994 bytesVBA/__SRP_0
A15309 bytesVBA/__SRP_1
A161038 bytesVBA/__SRP_10
A17197 bytesVBA/__SRP_11
A18476 bytesVBA/__SRP_12
A19103 bytesVBA/__SRP_13
A20762 bytesVBA/__SRP_14
A21226 bytesVBA/__SRP_15
A221036 bytesVBA/__SRP_2
A23149 bytesVBA/__SRP_3
A24758 bytesVBA/__SRP_4
A25194 bytesVBA/__SRP_5
A26830 bytesVBA/__SRP_6
A27140 bytesVBA/__SRP_7
A28276 bytesVBA/__SRP_8
A2966 bytesVBA/__SRP_9
A30276 bytesVBA/__SRP_a
A3166 bytesVBA/__SRP_b
A32716 bytesVBA/__SRP_c
A33197 bytesVBA/__SRP_d
A341060 bytesVBA/__SRP_e
A35177 bytesVBA/__SRP_f
A36736 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
AutoExecWorkbook_BeforeCloseRuns when the Excel Workbook is closed
SuspiciousEnvironMay read system environment variables
SuspiciousOpenMay open a file
SuspiciousPutMay write to a file (if combined with Open)
SuspiciousBinaryMay read or write a binary file (if combinedwith Open)
SuspiciousRunMay run an executable file or a systemcommand
SuspiciousCreateObjectMay create an OLE object
SuspiciousStrReverseMay attempt to obfuscate specific strings(use option --deobf to deobfuscate)
SuspiciousXorMay attempt to obfuscate specific strings(use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
MSO
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f6e83040-2942-4e17-b526-16ba1ef28753/
Malware family:
n/a
ID:
1
File name:
xlsm
Verdict:
No threats detected
Analysis date:
2026-08-08 17:34:50 UTC
Tags:
macros macros-on-open doc-url
Link:
https://app.any.run/tasks/bfd40d58-ccec-4329-b7c2-ba0c3b3dfc37

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/octet-stream
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79265/
Detection(s):
TwinWave.EvilDoc.CORedLightSyndrome.20210907.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WSCRIPT.SHELL.211119.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WSCRIPT.SHELL.200129.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ICEDIDOGORiginalGangsterCROMethodsM1.20200923.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ICEDIDOGORiginalGangsterCROMethodsM2.20200923.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CROKissFromARose.20201210.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WSCRIPT.210223.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Delayed writing of the file
Creating a process from a recently created file
Result
Verdict:
Malicious
File Type:
Excel File with Macro
Link:
https://app.docguard.net/9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b/results/dashboard
Behaviour
BlacklistAPI detected
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm dropper encrypted evasive expired-cert language-ru macros macros-on-open obfuscated packed
Link:
https://www.filescan.io/uploads/6a7767ca7fce16fded195a71/reports/24d2e774-ef45-4154-8334-941e509c69ba/overview
Verdict:
Malicious
Labled as:
GT:VB.Macros.Bomber.1
Link:
https://www.hybrid-analysis.com/sample/9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b
Label:
Benign
Suspicious Score:
/10
Score Malicious:
%
Score Benign:
1%
Link:
https://www.malware.ai/gui/files/?id=9c043521-d83b-474f-be61-92e278e85ed6
Verdict:
Malicious
File Type:
xlsm
First seen:
2026-08-07T09:22:00Z UTC
Last seen:
2026-08-08T16:43:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1954435
Signature
Antivirus / Scanner detection for submitted sample
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Multi AV Scanner detection for submitted file
Office process queries suspicious COM object (likely to drop second stage)
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1954435 Sample: TOKTOM_AI_Update.xlsm Startdate: 08/08/2026 Architecture: WINDOWS Score: 88 39 us1.roaming1.live.com.akadns.net 2->39 41 roaming.svc.cloud.microsoft 2->41 43 6 other IPs or domains 2->43 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Document contains an embedded VBA macro with suspicious strings 2->53 55 4 other signatures 2->55 9 EXCEL.EXE 216 51 2->9         started        14 EXCEL.EXE 9 21 2->14         started        16 ebook-edit.exe 2->16         started        18 ebook-edit.exe 2->18         started        signatures3 process4 dnsIp5 45 mr-z01.tm-azurefd.net 150.171.109.74, 443, 49728, 49730 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 9->45 47 52.110.2.188, 443, 49720 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 9->47 37 C:\Users\user\...\~$TOKTOM_AI_Update.xlsm, data 9->37 dropped 61 Office process queries suspicious COM object (likely to drop second stage) 9->61 20 ebook-edit.exe 5 9->20         started        24 splwow64.exe 1 9->24         started        file6 signatures7 process8 file9 33 C:\ProgramData\USOShared\...\ebook-edit.exe, PE32+ 20->33 dropped 35 C:\ProgramData\...\CAlibre-LAuncher.dll, PE32+ 20->35 dropped 57 Unusual module load detection (module proxying) 20->57 26 cmd.exe 1 20->26         started        signatures10 process11 signatures12 59 Uses schtasks.exe or at.exe to add and modify task schedules 26->59 29 conhost.exe 26->29         started        31 schtasks.exe 1 26->31         started        process13
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b
Verdict:
Malware
YARA:
4 match(es)
Tags:
Blacklist VBA DeObfuscated MSXML2.DOMDocument Obfuscated Office Document Scripting.FileSystemObject SVG T1027 T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/dcb4c95311d6c9f5519b1f66a0b5aa26
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b/
Threat name:
Script-Macro.Trojan.MacrosBomber
Create hunting rule
Status:
Malicious
First seen:
2026-08-07 13:06:17 UTC
File Type:
Document
Extracted files:
73
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvtl7xnwawgnc5ixplsulay5o3dewku2ifmf3aolqosu2dvpeefq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution macro persistence
Link:
https://tria.ge/reports/260808-v3klyav1ax/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Executes a command shell one-liner
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9d66bfddb605/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79265/

Comments